| Deep learning has evolved into a powerful and efficient framework that can be widely applied to complex learning problems that were previously difficult to solve using traditional machine learning techniques.However,deep neural networks(DNNs)are vulnerable to adversarial examples composed of malicious perturbations,which are almost imperceptible to the human eye but can trick deep models into making wrong predictions.Adversarial training(AT)is considered to be one of the most effective methods against adversarial attacks.However,the existing adversarial training methods often lead to a decrease in the prediction accuracy of natural data while improving the robustness of the model.In response to this problem,this paper proposes two improv ed adversarial training defense methods to enhance the robustness of the neural network model while maintaining the accuracy of the model’s natural data.(1)A confused-label instance-reweighted adversarial training is proposed.Reweighting adversarial examples during training plays an essential role in improving the robustness of neural networks,which lies in the fact that examples closer to the decision boundaries are much more vulnerable to being attacked and should be given larger weights.The probability margin(PM)method is a promising approach to continuously and path-independently measuring such closeness between the example and decision boundary.However,PM cannot effectively distinguish the examples having only one misclassified category and the ones with multiple misclassified categories,and the examples with multiple misclassified categories are closer to the multi-class decision boundary,so the PM method has limitations.To tackle this problem,this thesis proposes a confused-label-based PM(CL-PM)to measure the above closeness and reweight adversarial examples during training.Specifically,a confused label(CL)is defined as the label whose prediction probability is greater than that of the ground truth label given a specific adversarial example.Unlike the PM method which only considers the difference between the probability of the true label and the probability of the most misclassified label,the CL-PM method evaluates the closeness by accumulating the probabilities of all the CLs and ground truth label.CL-PM shares a negative correlation with data vulnerability: data with larger/smaller CL-PM is safer/riskier and should have a smaller/larger weight.Experiments demonstrated that CL-PM is more reliable in indicating the closeness regarding multiple misclassified categories,and reweighting adversarial training based on CL-PM outperformed state-of-the-art counterparts.(2)A model adversarial training method based on channel-wise importance feature selection(ICIFS)is proposed.Existing channel-wise importance-based feature selection(CIFS)method can further enhance the robustness of deep neural networks adversarial training by suppressing the negatively relevant(NR)channels and aligning the positively relevant(PR)channels with their relevances.Here,the weights of the last linear layer indicate the channels’ relevances to predictions.In the process of channel importance selection,the CIFS method ignores that the importance of the true label probability and the most misclassified label are not equal,which can lead to the limited performance of the CIFS method.In order to solve this problem,we propose the ICIFS method.Unlike the CIFS method,which obtains the relevance of each channel with the top-k prediction results by directly accumulating the gradient within the channel,this method first scales the channel gradients corresponding to the predicted labels and the channel gradients corresponding to the other misclassified labels in different equal proportions.Then,our method performs the gradient accumulation within the channels to increase the relevance between each channel and the predicted labels.The Dropout technique is also introduced to prevent the improved method from leading to overfitting of the model during training.Finally,the experimental results show that the improved adversarial training method can improve the prediction accuracy of the natural data and the robustness of the neural network model. |
